Agenda Document Pack - Audit and Scrutiny Committee - 28/06/2022
Moray Council · 28 June 2022
Back to Audit and Scrutiny Committee — 28 June 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Audit and Scrutiny Committee Tuesday, 28 June 2022 NOTICE IS HEREBY GIVEN that a Meeting of the Audit and Scrutiny Committee is to be held at Council Chambers, Council Office, High Street, Elgin, IV30 1BX on Tuesday, 28 June 2022 at 09:30. BUSINESS 1. Sederunt 2. Declaration of Group Decisions and Members Interests * 3. Minutes of meeting of 30 March 2022 5 - 6 4. Written Questions ** 5. Report on the Work of the Internal Audit Section in the Period from 1 April 2022 to 28 June 2022 Report by Depute Chief Executive (Education, Communities and Organisational Development) 7 - 28 6. Internal Audit Annual Report 2021-22 Report by Depute Chief Executive (Education, Communities and Organisational Development) 29 - 38 7. Moray Council Annual Audit Plan 2021-22 Report by Audit Scotland 39 - 58 8. Question Time *** Consider any oral question on matters delegated to the Committee in terms of the Council's Scheme of Administration. Page 1
Page 2
Summary of Audit and Scrutiny Committee functions: Audit Functions - Consider reports from the Council's internal auditor & Audit Scotland concerning Council Functions. Scrutiny Functions - Scrutinising the policies of the Council and their effectiveness in meeting the action plans of the Council as set out in the Corporate Development Plan and evaluating the actions of Committees in implementing the action plans set out in the Corporate Development Plan. Performance Monitoring - To receive reports on the performance of and trends within all of the Council’s services in terms of service standards and performance information. Standards - To ensure that the highest standards of probity and public accountability are demonstrated. Any person wishing to attend the meeting should contact customer services on 01343 563217 prior to the meeting as the number of attendees is restricted due to the recent Covid pandemic You can however watch the webcast of the meeting by going to : http://www.moray.gov.uk/moray_standard/page_43661.html Page 2
Page 3
GUIDANCE NOTES * Declaration of Group Decisions and Members Interests - The Chair of the meeting shall seek declarations from any individual or political group at the beginning of a meeting whether any prior decision has been reached on how the individual or members of the group will vote on any item(s) of business on the Agenda, and if so on which item(s). A prior decision shall be one that the individual or the group deems to be mandatory on the individual or the group members such that the individual or the group members will be subject to sanctions should they not vote in accordance with the prior decision. Any such prior decisions will be recorded in the Minute of the meeting. ** Written Questions - Any Member can put one written question about any relevant and competent business within the specified remits not already on the agenda, to the Chair provided it is received by the Proper Officer or Committee Services by 12 noon two working days prior to the day of the meeting. A copy of any written answer provided by the Chair will be tabled at the start of the relevant section of the meeting. The Member who has put the question may, after the answer has been given, ask one supplementary question directly related to the subject matter, but no discussion will be allowed. No supplementary question can be put or answered more than 10 minutes after the Council has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he or she can submit it in writing to the Proper Officer who will arrange for a written answer to be provided within 7 working days. *** Question Time - At each ordinary meeting of the Committee ten minutes will be allowed for Members questions when any Member of the Committee can put a question to the Chair on any business within the remit of that Section of the Committee. The Member who has put the question may, after the answer has been given, ask one supplementary question directly related to the subject matter, but no discussion will be allowed. No supplementary question can be put or answered more than ten minutes after the Committee has started on the relevant item of business, except with the consent of the Chair. If a Member does not have the opportunity to put a supplementary question because no time remains, then he/she can submit it in writing to the proper officer who will arrange for a written answer to be provided within seven working days. Page 3
Page 4
THE MORAY COUNCIL Audit and Scrutiny Committee SEDERUNT Councillor Graham Leadbitter (Chair) Councillor Shona Morrison (Depute Chair) Councillor Peter Bloomfield (Member) Councillor Tracy Colyer (Member) Councillor Theresa Coull (Member) Councillor John Divers (Member) Councillor Amber Dunbar (Member) Councillor Jérémie Fernandes (Member) Councillor Donald Gatt (Member) Councillor David Gordon (Member) Councillor Sandy Keith (Member) Councillor Neil McLennan (Member) Councillor Christopher Price (Member) Clerk Name: Lindsey Robinson Clerk Telephone: 07966 120593 Clerk Email: committee.services@moray.gov.uk Page 4
Page 5
MORAY COUNCIL Minute of Meeting of the Audit and Scrutiny Committee Wednesday, 30 March 2022 Remote Locations via Video Conference, PRESENT Councillor George Alexander, Councillor Frank Brown, Councillor John Cowe, Councillor John Divers, Councillor Donald Gatt, Councillor Graham Leadbitter, Councillor Marc Macrae, Councillor Aaron McLean, Councillor Shona Morrison, Councillor Sonya Warren APOLOGIES Councillor Tim Eagle, Councillor Ryan Edwards, Councillor Maria McLean, Councillor Walter Wilson IN ATTENDANCE Also in attendance were the Chief Executive, Depute Chief Executive (Education, Communities and Organisational Development), Head of Governance, Strategy and Performance, Internal Audit Manager and Tracey Sutherland, Committee Services Officer. 1. Welcome The Chair welcomed everyone to the last meeting of the Committee prior to the Local Government Elections in May 2022. 2. Declaration of Group Decisions and Members Interests * In terms of Standing Order 20 and the Councillors’ Code of Conduct, there were no declarations from Group Leaders or Spokespersons in regard to any prior decisions taken on how Members will vote on any item on the agenda or any declarations of Member’s interests in respect of any item on the agenda. 3. Minute of Meeting of 16 February 2022 The minute of the meeting of the Audit and Scrutiny Committee dated 16 February 2022 was submitted and approved. 4. Written Questions ** The Committee noted that no written questions had been submitted. Item 3. Page 5
Page 6
5. Report on the Work of the Internal Audit Section in the Period from 17 February 2022 to 30 March 2022 A report by the Depute Chief Executive (Education, Communities and Organisational Development) advised the Committee on the work of the Internal Audit Section for the period from 17 February 2022 to 30 March 2022. Following consideration, in which Officers answered questions regarding Council Tax and the Early Learning and Childcare project the Committee agreed to note the contents of the report. Councillors A McLean and Warren joined the meeting during the consideration of this item. 6. Work of the Internal Audit Section Update A report by the Depute Chief Executive (Education, Communities and Organisational Development) provided Committee with an update on the work of the Internal Audit Section. Following consideration the Committee agreed to note the contents of the report. 7. Internal Audit Plan - Year Ending 31 March 2023 A report by the Depute Chief Executive (Education, Communities and Organisational Development) provided the Committee with details of the planned internal audit coverage for the year ending 31 March 2023. Following consideration the Committee agreed to note: i) the proposed internal audit coverage for the 2022/23 financial year; and ii) the possible disruption in the service provided by the Internal Audit Section due to the limitations placed on current and potential future working practices from the impact of the pandemic. 8. Thanks The Committee joined the Chair in thanking the Internal Audit team for all their hard work and guidance over the last 5 years. Page 6
Page 7
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 28 JUNE 2022 SUBJECT: REPORT ON THE WORK OF THE INTERNAL AUDIT SECTION IN THE PERIOD FROM 1 APRIL 2022 TO 28 JUNE 2022 BY: DEPUTE CHIEF EXECUTIVE (EDUCATION, COMMUNITIES AND ORGANISATIONAL DEVELOPMENT) 1. REASON FOR REPORT 1.1 The report advises Committee on the work of the Internal Audit Section for the period from 1 April 2022 to 28 June 2022. 1.2 This report is submitted to Committee in terms of Section III (I)(2) and (7) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service carried out by Internal Audit. 2. RECOMMENDATION 2.1 That Committee consider the contents of this report, seeks clarification on any points noted and otherwise notes the report. 3. BACKGROUND 3.1 This report provides details of the internal audit work concluded during the period 1 April 2022 to 28 June 2022. Departmental Systems – Health & Social Care Moray - Client Monies 3.2 An audit review has been undertaken into the management and accounting systems of social care clients monies held under corporate appointeeship arrangements. Individuals assessed as requiring assistance in the financial management of welfare benefits received, the Department for Work and Pensions (DWP) can appoint a Social Work Officer to become the 'Corporate Appointee' and have legal authority for fund administration. The scope of the audit was to ensure funds were appropriately handled, stored, recorded and administered on behalf of clients, in line with agreed policy and procedures. The executive summary and recommendations for this project are given in Appendix 1. Item 5. Page 7
Page 8
Departmental Systems – Primary School Estates Security 3.3 This audit reviewed the controls to restrict unauthorised access to primary school buildings and grounds. It was found that the age, type of school buildings and locations of play areas do vary considerably across the Authority. This does present challenges in ensuring the implementation of consistent security arrangements. The audit reviewed policies, procedures, and an appraisal of the security controls operating within a sample of primary schools. The audit found examples of good practices and improvements that have been made to the physical security of the primary school estates. However, the review has also highlighted where further improvements should be considered. The executive summary and recommendations for this project are given in Appendix 2. Departmental Systems – Building Services Stores 3.4 A review was undertaken of the Building Services Stores. The audit reviewed the systems and controls in managing materials and equipment (stock) stored to meet the repairs and maintenance requirements of Council housing. Individual stock items can vary in value from a few pounds to upwards of £1,000. Materials and equipment with a cumulative value of approximately £700 000 are issued annually from Stores. The executive summary and recommendations for this project are given in Appendix 3. 3.5 Departmental Systems – Roads Maintenance - Planned The Roads Maintenance Capital Plan budget for 2021/22 amounted to £4.282 million. This included planned projects for resurfacing, surface dressing programme, footway and drainage works. This is part of an agreed 10 year Capital Plan to address Moray's deteriorating road conditions. The audit undertook an overview of the 2021/22 capital plan and selected individual projects where more detailed audit checks were undertaken. Testing involved a review of the contract management arrangements and how individual schemes are costed, agreed and monitored. The executive summary and recommendations for this project are given in Appendix 4. 4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications. Page 8
Page 9
(f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 5. CONCLUSION 5.1 This report provides Committee with a summary of findings arising from an audit project completed during the review period. Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: SPMAN-1042990102-106 Page 9
Page 10
Page 10
Page 11
Appendix 1 AUDIT REPORT 22'011 CLIENT MONIES Executive Summary The annual audit plan for 2021/22 provides for an audit review to be undertaken of how Health and Social Care Officers manage income held for individuals under Corporate Appointeeship arrangements. Where no alternative exists, the Council can make an application to the Department for Work and Pensions (DWP) for a named officer to become the 'Corporate Appointee' and have the legal authority to manage an individual's personal finances. The Adults with Incapacity (Scotland) Act 2000 enables a Health and Social Care Officer to be appointed by the DWP to have "Corporate Appointeeship" responsibility for managing the benefits received by an individual. It was noted that other formal agreements do exist, e.g. Access to Funds Scheme, Intervention or Guardianship orders, but a review of these arrangements was not included within this review. It was found that 59 individuals are being managed within the "Corporate Apppointeeship" Scheme with a combined value of £483,000 held within the Council's corporate bank account. The audit has involved scrutiny of processes undertaken by the Community Care Finance Team in how they administer the corporate bank account. In addition, a sample of individuals was also selected, and a check made as to how the Heath and Social Care Officer appointed as the named "Corporate Appointee" manages and supports individuals to access their funds appropriately. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). The review has highlighted the following areas for improvement:- • Due to the requirements of remote working and pandemic restrictions, the withdrawal of cash for clients has moved to a 4-weekly cycle. This has resulted in changes in operating practices. A risk assessment review of current arrangements should be undertaken to ensure best practices are followed for the protection of both employees and the client's finances. Once this is carried out, procedures require to be updated to reflect the agreed operating arrangements. • A lack of segregation of duties exists with the bank reconciliation being prepared by the same officers who operate the account on a daily basis. An independent management check should be included within this process. • The audit notes that the corporate bank account included £80,482 of funds in relation to the combined balances of 10 deceased clients. Some of these funds have been held for a period of up to 4 years with no contact made by any executor of the deceased clients. Clarification should be obtained from Legal Services regarding the length of time funds must be retained on behalf of deceased clients and potential action that could be taken should the funds not be claimed within the timeframe. Item 5. Page 11
Page 12
Appendix 1 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Clear and current policy documents and operational guidelines have been developed for the financial management of client monies. 5.01 The Procedures for Managing Service User's Money and Corporate Appointeeship should be reviewed and updated and a subsequent regular cycle of review maintained. Medium Yes Procedures will be reviewed to incorporate improvements and changes to practice. Commissioning Manager 31/10/2022 5.02 Procedures for the management of client monies should be promoted to ensure there is an awareness of their requirements by all officers involved in client finance administration. Medium Yes Procedures will be appropriately promoted to relevant officers after revision. Commissioning Manager 31/10/2022 Page 12
Page 13
Appendix 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Correct formal powers to administer client monies have been obtained. 5.03 Clarification should be obtained from Legal Services regarding the length of time funds must be retained on behalf of deceased clients and potential action which can be taken should the funds not be claimed within the timeframe. Consideration should also be given to holding these funds separate to the corporate bank account for increased visibility. Medium Yes Clear guidance will be requested from Legal Services in order to be able to conclude deceased estates. This will be added to procedures to ensure deceased client monies are not being held in the corporate bank account beyond acceptable timescales. Community Care Finance Officer / Support Manager 31/10/2022 Page 13
Page 14
Appendix 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: All transactions should be for benefit of the client with justifiable supplier selection, verified to source documentation and in line with the client's Financial Management Plan. Any cash held is done so securely and with full accounting arrangements. 5.04 Due to changes in operating practices a full review of current cash handling procedures should be undertaken. The review should include a risk assessment to ensure best practices are followed regarding the safety and security of both officers and client funds. Documented procedures should thereafter be updated to reflect any agreed changes. High Yes Options to be prepared for discussion by the Practice Governance Group to agree cash handling procedures and practices which increase security whilst being practical within operational capacity. Community Care Finance Officer / Support Manager 31/07/2022 Key Control: Robust records of fund administration per client are maintained. 5.05 Confirmation of the monthly reconciliation of the Corporate bank account to manual records should be undertaken by Community Care Finance management. This should also include the verification of a sample of transactions to source documentation. High Yes A four-weekly management review will be implemented and added to the revised procedures. Community Care Finance Officer / Support Manager 31/05/2022 Page 14
Page 15
Appendix 2 AUDIT REPORT 22'017 PRIMARY SCHOOL ESTATES SECURITY Executive Summary The annual audit plan for 2021/22 provides for an audit review to be undertaken of the controls to restrict unauthorised access to primary school buildings and grounds. It was found that the age, type of school buildings and locations of play areas do vary considerably across the Authority. This does present challenges in ensuring the implementation of consistent security arrangements. The scope of the audit reviewed policies, procedures, and an appraisal of the security controls within primary schools. The audit not only included a review of guidelines issued centrally by the Education Service but also instructions or handbooks that individual schools may have developed. The audit process involved selecting a sample of primary schools to visit where the actual security controls operating in practice were observed and tested. It was also noted that some schools had attached early years nurseries. The audit was carried out in accordance with the Public Sector Internal Audit Standards (PSIAS). The audit found examples of good practices and improvements that have been made to the physical security of the primary school estates. However, the review has highlighted where further improvements should also be considered. • Examples were found where individual schools have developed good internal security procedures to control access to the building, grounds and play areas. However, no central guidance had been issued to assist schools in implementing good security practices. • The audit visits to primary schools confirmed a security door access system in operation that controlled access from the reception area into the main school building. However, testing at two schools noted a control weakness concerning the particular type of security entry system used. All schools with a similar security system have been identified, and remedial action is underway. • Physical controls to restrict access to school grounds and play areas varied. It is appreciated the challenges facing some schools regarding this issue. Consideration should be given for every school to undertake a risk assessment of their security risks and the mitigating controls that should be considered. Item 5. Page 15
Page 16
Appendix 2 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: The controls around school access are sufficient to prevent unauthorised entry to primary schools. 5.01 Guidance should be prepared and issued to all schools detailing good security practices. Due to the different nature of individual schools with regard to buildings, play areas, etc.; consideration should be given for each school to develop its own documented security procedures. Medium Yes Work on guidance has commenced. Each school to be supported in producing its own security procedures in line with Council wide guidance. Resources Officer (ERC) Resources Officer and Head Teachers 31 August 2022 for guidance document. 31 December 2022 for local school procedures to be developed. Page 16
Page 17
Appendix 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.02 Remedial action should be undertaken to resolve the security concerns found during the audit regarding a door entry security system. High Yes Work is complete. Implemented 5.03 A review of the CCTV arrangements including coverage requirements for all primary school estates should be undertaken. Medium Yes Programme of CCTV implementati on/upgrade ongoing. Coverage requirement to be reviewed as part of guidance (ref 5.01). Resources Officer (ERC) 31/08/2022 Page 17
Page 18
Appendix 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.04 A standardised recording system should be introduced within all primary schools to ensure a consistent approach is followed in the recording of incidents or concerns. In addition, notices/ posters should be displayed within Schools to remind staff and pupils to follow good security practices. Medium Yes To be incorporated into guidance (ref: 5.01). Resources Officer (ERC) 31/08/2022 5.05 Regular training to promote good security practices should be provided to all staff within schools. Medium Yes Service discussion underway as to best approach to implement this. Resources Officer (ERC) and Head Teachers Ongoing from 31 August 2022 Page 18
Page 19
Appendix 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.06 Each primary school should undertake a documented assessment of the buildings and grounds including play areas to assess current security risks and the controls implemented or required to mitigate these risks. Medium Yes Risk assessment guidance to be included in School Security Guidance (ref 5.01). Resources Officer (ERC) and Head Teachers 31 August 2022 for risk assessment guidance. 31 December 2022 for risk assessments to be completed. Page 19
Page 20
Page 20
Page 21
Appendix 3 AUDIT REPORT 22'019 BUILDING SERVICES - STORES Executive Summary The annual Internal Audit plan for 2021/22 provided for a review to be undertaken of the Building Services Stores. The main storage location for materials and equipment (stock) is at the Mosstodloch Depot, with a sub store at Keith. Various types of materials and equipment are held to meet the repairs and maintenance requirements of Council housing. Individual stock items can vary in value from a few pounds to upwards of £1,000. It was noted that materials and equipment with an overall value of approximately £700 000 are issued annually from Stores. The audit used the Chartered Institute of Public Finance Accountants audit programme to review the systems and controls in managing stock held within stores. Building Services use a software application called Servitor for administering the stores system. Testing also included a review of the security arrangements to safeguard against unauthorised access to the storage areas. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). The review has highlighted the following areas for improvement:- • The audit visit noted approximately £7000 of stock items held within the Mosstodloch Depot but not recorded within Servitor. Enquiries found the items stored related to “direct orders” already allocated to a specific job. All materials and equipment purchased and held within the Depot should be recorded within Servitor to ensure the accountability and control of all stock items stored. • It was noted that Servitor has functions and reporting facilities to assist in the effective management of a stores system. However, it was found that no minimum or maximum stock figures have been set against each stock item. The maintenance of stock levels at the appropriate levels is important to ensure the cost effective and efficient delivery of the Service. • During the audit visit, a check was undertaken of a sample of stock items recorded within Servitor to the actual items held. Testing found minor variances in a few of the items checked. Enquiries noted these were due to recoding errors when entering or issuing stock items from Servitor. Regular stock checks are undertaken to highlight variances. Greater care should be taken, however the planned introduction of a new bar code system should ensure greater accuracy. Item 5. Page 21
Page 22
Appendix 3 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Review of the Building Services Stores to ensure effective controls are operating in the management and control of materials and equipment. 5.01 Building Services equipment and materials purchased as a direct order for specific schemes and stored at the Depot should be recorded within Servitor. Medium Yes Procedures have been put in place to ensure that high value direct orders are booked in to stock via Servitor (e.g. boilers).Other direct orders (e.g. kitchens) will be quarantined in a designated secure holding area, with transaction details recorded in Servitor. Business Co- ordinator/Busin ess Manager 31/03/2023 Page 22
Page 23
Appendix 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.02 Higher value items should be stored whether possible in alarmed storage areas. Medium Yes Measures have been put in place to ensure that high value items are stored in a secure and alarmed area. Business Co- ordinator 31/05/2022 5.03 Officers should be reminded that greater care should be taken to record items received and issued within Servitor. Medium Yes Moving to barcoding system (Datastox) to issue stock. Weekly stock checks carried out. Ongoing training with staff. Business Co- ordinator/Busin ess Manager 30/06/2022 Page 23
Page 24
Appendix 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.04 All materials and equipment recorded within Servitor should be updated with minimum and maximum stock levels. This should assist in the effective management of stock levels at the appropriate levels. Low Yes Working with Datastox to ensure maximum stock levels are not breached. Business Co- ordinator/Busin ess Manager 31/12/2022 5.05 Contracts should be agreed with companies used regularly for the supply of goods and materials where annual expenditure exceeds the Quick Quote threshold of £5000. Medium Yes Off contract spend for stock purchases to be reviewed. Contracts to be put in place where necessary. Business Co- ordinator/Busine ss Manager 31/03/2023 Page 24
Page 25
Appendix 4 AUDIT REPORT 22'014 ROADS MAINTENANCE - PLANNED Executive Summary The annual audit plan for 2021/22 provided for a review to be undertaken of roads maintenance planned repairs. The Roads Maintenance Capital Plan budget for 2021/22 amounted to £4.282 million. This included planned projects for resurfacing, surface dressing programme and footway and drainage works. This is part of an agreed 10 year Capital Plan to address Moray's deteriorating road conditions. The audit noted the Service had experienced several challenges during 2021/22, including staffing shortages and pandemic health and safety restrictions affecting working practices. This has required the prioritisation of works with an emphasis on the completion of resurfacing and surface dressing works. As a result, it was not possible to complete the footway and drainage work programmes that were originally agreed. However, these projects have been carried forward for inclusion within a future works programme. The audit scope involved an overview of the capital plan and the selection of individual projects where more detailed audit checks were undertaken. Testing involved a review of the contract management arrangements and how individual schemes are costed, agreed and monitored. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). The review has highlighted the following areas for improvement:- • It was noted that the total cost of works payable for the schemes undertaken by the in house contractor are calculated from established costing arrangements, i.e., Schedule of Rates, Bill of Quantities or actual cost, including oncosts. It was found that changes to individual work rates are determined by a need to ensure the in house contractor meets their operating costs and provides a rate of return. A value for money review should be considered to justify the individual work and oncost rates payable to the in house contractor. • Evidence of monitoring was found of the Service reviewing the quality, costs, and compliance with conditions of contracts of schemes awarded to contractors. The majority of works are issued to the in house contractor, however, a more structured performance management framework should be considered to ensure best value is achieved. • Established operating arrangements were found to be in place. However, these have not been documented to ensure working practices adhere to the best contract management procedures. Item 5. Page 25
Page 26
Appendix 4 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Works met by the capital budget provision follow proper procurement procedures, are monitored effectively and accurately costed. 5.01 A review of the in-house contractor Schedule of Rates should be undertaken to ensure individual costings provide value for money. As works are also awarded directly to the in house contractor based on a Bill of Quantities, the same requirement should be undertaken. Yearly changes to individual rates should also be reviewed to ensure best value is achieved for the costs charged. Medium Yes Undertake a review of in house Schedule of Rates. Carry out model job pricing comparisons with external suppliers. Roads Maintenance Manager & Senior Engineer Roads Maintenance 31/03/2023 5.02 Oncost percentages charged on works completed by the in house contractor should be reviewed to ensure the rates Medium Yes Review the oncost percentage rates and Roads Maintenance Manager & Accountant 31/03/2023 Page 26
Page 27
Appendix 4 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation used reflect the expenditure incurred. compare with other local authority service providers. 5.03 Consideration should be undertaken to develop a range of performance indicators to monitor the works undertaken by private and in-house contractors. Medium Yes Develop an internal performance review form to be used and completed following scheme completion. Network Asset Engineer 31/03/2023 5.04 Operating procedures should be documented to assist officers in managing projects and ensuring working practices follow recommended civil engineering conditions. Medium Yes Develop individual scheme file pack for all internal works over £5k. Senior Engineer Roads Maintenance & Network Asset Engineer 31/07/2022 Page 27
Page 28
Page 28
Page 29
REPORT TO: AUDIT AND SCRUTINY COMMITTEE ON 28 JUNE 2022 SUBJECT: INTERNAL AUDIT ANNUAL REPORT – 2021/22 BY: DEPUTE CHIEF EXECUTIVE (EDUCATION, COMMUNITIES AND ORGANISATIONAL DEVELOPMENT 1. REASON FOR REPORT 1.1 To provide Committee with a copy of the Internal Audit Annual Report for the year ended 31 March 2022, together with the Audit and Risk Manager’s opinion on the adequacy and effectiveness of the council’s system of internal control. 1.2 This report is submitted to Committee in terms of Section III (I) (2) and (7) of the Council’s Scheme of Administration relating to consideration of reports from the Council’s Internal Auditor and monitoring delivery of the audit service carried out by Internal Audit. 2. RECOMMENDATION 2.1 That Committee considers the contents of the annual report given as Appendix 1 to this report and seeks clarification on any matters relating thereto. 3. BACKGROUND 3.1 The purpose of this report is to present to the Audit and Scrutiny Committee the Internal Audit Annual Report for the year to 31 March 2022, which includes the Audit and Risk Manager's independent assurance opinion on the adequacy of the Council's overall control environment. 3.2 The Public Sector Internal Audit Standards (PSIAS) requires the Chief Audit Executive (CAE), the Council’s Audit and Risk Manager, to provide an annual internal audit opinion and report on the adequacy and effectiveness of the Council’s governance, risk management and internal controls to support the preparation of the Annual Governance Statement. 3.3 To meet the requirements of the PSIAS, the Internal Audit Annual Report 2021/22, at Appendix 1, includes the annual Internal Audit opinion and provides details of the Internal Audit activity and performance during the year. Item 6. Page 29
Page 30
4. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcome Improvement Plan (LOIP)) Internal audit work supports good governance and the delivery of efficient services. (b) Policy and Legal No implications. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications The independent review of selected systems and procedures mitigates the risks associated with inadequate or ineffective control procedures. (e) Staffing Implications No implications. (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts No implications. (i) Consultations There have been no direct consultations during the preparation of this report. 5. CONCLUSION 5.1 The Internal Audit annual report provides a summary overview of the nature and extent of audit work carried out during the year to inform the audit opinion on the internal control environment operating within the Council. Author of Report: Dafydd Lewis, Audit and Risk Manager Background Papers: Internal audit files Ref: SPMAN-1042990102-100 Page 30
Page 31
APPENDIX 1 INTERNAL AUDIT ANNUAL REPORT and OPINION 1 APRIL 2021 to 31 MARCH 2022 Item 6. Page 31
Page 32
CONTENTS Page SECTION 1 – INTRODUCTION 2-3 SECTION 2 – BASIS OF OPINION 3-4 SECTION 3 – SUMMARY AND LIMITATIONS OF WORK THAT SUPPORTS OPINION 4-8 SECTION 4 – OPINION 8 Page 32
Page 33
SECTION 1 – INTRODUCTION Purpose of this report This report is issued in compliance with the Public Sector Internal Audit Standards (PSIAS), which requires the Audit and Risk Manager to deliver ‘an annual internal audit opinion and report that can be used by the organisation to inform its governance statement’, and which ‘must conclude on the overall adequacy and effectiveness of the organisation’s framework of governance, risk management and control’. This report constitutes the required statement. It is management’s responsibility to maintain risk management systems, internal control and governance. Internal Audit is an element of the internal control framework established by management to examine, evaluate and report on accounting and other controls over operations. Internal Audit assists management in the effective discharge of its responsibilities and functions by examining and evaluating controls. Internal Audit cannot be held responsible for internal control failures. Internal Audit’s role includes assessing the adequacy of the risk management, internal controls and governance arrangements put in place by management and performing testing on a sample of transactions to ensure those controls were operating for the period under review. Public Sector Internal Audit Standards (PSIAS) require officers of the Internal Audit Section to communicate on a timely basis all facts and matters that may have a bearing on their independence. I can confirm that all staff members involved in 2021/22 internal audit reviews were independent of operational processes and their objectivity was not compromised in any way. SECTION 2- BASIS OF OPINION This opinion is based on my knowledge of the Council’s governance, risk and control processes and from audit work completed during the period to 31st March 2022. There are limitations to the level of assurance that can be provided dependent on the scope and coverage of the audit work completed. My evaluation is based on the following: • The audit work undertaken by Internal Audit during the year to 31st March 2022. • The assurance statements signed by Heads of Services on the operation of the internal financial controls for the services they were responsible for during the year to 31st March 2022. • The governance statement signed by the Chief Executive for the overall Council for the year ended 31st March 2022. Page 33
Page 34
• Reports issued by the Council’s External Auditor, Audit Scotland, and other external review agencies. • My knowledge of the Council’s governance, risk management and performance monitoring arrangements. SECTION 3- SUMMARY AND LIMITATIONS OF WORK THAT SUPPORTS THE OPINION Internal audit operates independently within the organisation. While there may have been limitations in the scope of the audit due to the pandemic, there have been no limitations imposed by management on the scope of audit work performed. The internal audit opinion has been informed by the audit work completed during the year. The annual audit plan presented to the Audit and Scrutiny Committee at the start of the year describes in some detail the framework around which audit work is developed. In addition, the selection of audit topics was selected having regard to corporate planning documents, budget data and information drawn from the corporate risk register, and takes into account input from senior management regarding possible areas for audit. The work undertaken by Internal Audit in 2021/2022 is summarised below. The internal audit work has been conducted in accordance with an established methodology that promotes quality and conformance with the Public Sector Internal Audit Standards and the agreed Internal Audit Annual Audit Plan. Progress on the 2020/2021 Internal Audit Plan Progress against planned audit work for the year to 31 March 2022 can be summarised as follows:- Planned audit coverage Status Housing Benefits - Rent Rebates and Rent Allowances Completed Procurement and Creditor Payments Completed Purchasing Cards C/f to a future audit plan Council Tax Completed Capital Plan Completed Stocks and stores - year end valuations Completed Cyber security C/f to 22/23 audit plan Environmental Services- Collection and accounting of planning fees C/f to 22/23 audit plan Page 34
Page 35
Environmental Services - Roads Maintenance (Planned) Completed (capital plan projects included within audit testing) Environmental Services - Business Continuity Completed Environmental Services - Housing and Property - Stores Completed Corporate Services- Social Media Accounts Completed Corporate Services- Petty Cash Completed Education- Primary and Early Years Security Completed Client Monies Completed Self Directed Support Completed Each year, an element of the plan covers work on core financial systems, which are of key significance to the Council in terms of good financial governance. These systems receive the most significant focus in terms of management control and are also reviewed on a cyclical basis by the External Auditor to obtain assurances needed for the audit of the annual accounts. Internal Audit takes account of planned external audit work to avoid duplication; and undertakes work that external audit can use to inform its own work. Summaries of the issues arising in relation to each system or activity covered by internal audit work in 2021/2022 have been reported separately to the Audit and Scrutiny Committee. Appropriate responses to the recommendations are also included. When actioned, the recommendations made in the internal audit reports should provide management with additional comfort that the system of control operates as intended. It is therefore imperative that the agreed actions are implemented by management. The impact of COVID-19 has affected the Internal Audit Service in that officers have been working from home that has required a change to established working practices e.g. make greater use of audio, video, and screen sharing software applications. These changes in working practices have brought challenges, however the use of an Internal Audit Software Application has assisted in ensuring consistency in working practices. The Service has also had several staff vacancies during the year. However, moving forward all positions have now been filled. Despite these constraints, it has been possible to progress completion of the Audit Plan for 2021/22. Unfortunately, due to the limitations detailed and an unplanned audit project regarding a financial review concerning the Early Learning and Childcare Service, it has not been possible to fully complete the Audit Plan. However, the audit review of Cyber Security has been carried forward to the 2022/23 Internal Audit Plan. This is a particularly complex area, with recent high profile attacks on organisations highlighting the importance of ensuring controls are operating effectively. The impact of a successful cyber attack would immediately affect how the Council would be able to continue providing day to day services. Page 35
Page 36
The total number of recommendations made is set out in the following table: Report Risk Ratings for Recommendations System/ Testing Assessment High Medium Low 2021/22 Audit Plan H Housing Benefits - Rent Rebates and Rent Allowances 0 0 0 Full Procurement and Creditor Payments 0 0 0 Full Council Tax 0 1 1 Substantial Environmental Services - Roads Maintenance (Planned) 0 4 0 Limited Environmental Services - Business Continuity 0 5 0 Limited Environmental Services - Housing and Property - Stores 0 4 1 Substantial Corporate Services- Social Media Accounts 0 5 0 Substantial Corporate Services- Petty Cash 0 3 0 Substantial Education- Primary and Early Years Security 1 5 0 Substantial Client Monies 2 3 0 Substantial Self Directed Support 6 4 2 Substantial Early Learning and Childcare (Unplanned) 6 1 0 Limited The following performance measures were in place for 2021/2022: Measure Description Target Actual Final Report Percentage of Auditee(s) responding within 20 days of receiving the draft report. 100% 77% Final Report Percentage of final audit reports issued within 10 days of agreeing the draft report 100% 100% Audit Plan Delivery Percentage of audits completed v planned. 85% 81% Audit Budget Percentage of audits completed within budgeted days. 80% 88% Audit Recommendations Percentage of audit recommendations agreed. 90% 100% Customer Feedback Percentage of respondents who rated that the audit added value and provided meaningful results. 100% 100% Governance – in supporting the preparation of the Council’s Annual Governance Statement, sufficient information was obtained by Internal Audit to conclude that the Council generally complies with the latest good governance practice issued by CIPFA / SOLACE, and that the Corporate Management Team (comprising the Chief Executive, two Depute Chief Executives and the Chief Officer - Moray Health and Social Care ) and Senior Managers have a strong awareness of the challenges facing the Council in the incoming period. Written assurances from senior managers also considered governance practice within individual service areas. Page 36
Page 37
Key governance and internal control arrangements have been maintained, albeit capacity issues called for resources to be prioritised, not only to essential services but also to take forward the Council's strategic priorities. Internal Audit noted progress made in several key priority areas while supporting the development of the annual governance statement. It was noted that the Council’s management response to the COVID-19 pandemic included an amended to governance arrangements. Committee agreed in June 2021 to continue with the webcasting of meetings and the temporary change to the Scheme of Delegation in allowing the Chief Executive to discharge the Authority's functions without the need for homologation. Risk Management – procedures have been developed with a risk management policy in place and risk registers maintained at corporate and service levels. The format of the corporate risk register was amended during the year to provide greater transparency around the principal risks facing the organisation and the Corporate Management Team carefully considered how these risks could be managed. Political and financial risks figured highly given the acute challenges the Council has faced and continues to face going forward. Successful implementation of the Improvement and Modernisation programme will be vital to improving the future efficiency and sustainability of Council services. Risk management at service levels continued to be driven by individual managers in the absence of any supporting risk management resource. A lack of progress has been noted within services regarding the development and updating of Risk Management Plans. Additional resources have now been provided to appoint an officer with specific responsibility to support all services to progress more effective risk management and business continuity arrangements. Statement on Conformance with the Public Sector Internal Audit Standards The Local Authority Accounts (Scotland) Regulations 2014 require public bodies to operate a professional and objective internal auditing service in accordance with recognised standards and practices in relation to internal auditing, the Public Sector Internal Audit Standards. The Scottish Local Authorities Chief Internal Auditors’ Group, comprising the audit managers or equivalent of all Scottish Councils, has developed a checklist for assessing conformance with the Standards. This supports the requirement for self-assessment and external assessments as part of Internal Audit’s Quality Assurance and Improvement Programme. Internal monitoring of performance against the Standards will continue on an ongoing basis until the next External Quality Assessment, scheduled for 2023, is completed. However, a more structured self-assessment quality review is planned to highlight any issues arising from changing working practices and service delivery due to the pandemic. Page 37
Page 38
Two outstanding recommendations from the External Quality Assessment remain, one in respect of developing an ‘assurance map’ of all the assurances available to the Council, which on reflection and following further discussion with the assessor, has been agreed as low priority at present, and two in relation to the recommendation of having the Audit and Risk Manager ‘signing-off’ committee reports. Assurance mapping is an issue that has been raised within the Scottish Local Authorities Chief Internal Auditors’ Group, and it is hoped that a standardised approach could be developed. In regard to the Audit and Risk Manager “signing-off" committee reports, this does not align with Council Policy. The requirement for the Audit and Risk Manager to “sign-off” committee reports concerns the need to demonstrate and evidence the Auditor's independence from management. SECTION 4- OPINION Any system of control can only ever provide reasonable and not absolute assurances that control weaknesses or irregularities do not exist or that there is no risk of error, fraud, or breaches of laws or regulations. Furthermore, it is the responsibility of management to establish an appropriate sound system of internal control and to monitor the effectiveness of that system. It is the responsibility of the Audit and Risk Manager to provide an annual assessment of the robustness of the internal control system. It is my opinion, based on the audit work completed and other sources of assurance, that reasonable assurance can be placed on the adequacy and effectiveness of the Council’s internal control system for the year ending 31 March 2022. Dafydd Lewis Audit and Risk Manager 26th of May 2022 Page 38
Page 39
Prepared for Moray Council April 2022 Moray Council Annual Audit Plan 2021/22 Item 7. Page 39
Page 40
Moray Council Annual Audit Plan 2021/22 | 2 Contents Introduction 3 Financial statements audit planning 5 Audit dimensions and Best Value 11 Reporting arrangements, timetable, and audit fee 14 Other matters 17 Page 40
Page 41
Introduction | 3 Introduction Summary of planned audit work 1. This document summarises the work plan for our 2021/22 external audit of Moray Council (the council). The main elements of our work include: • evaluation of the key controls within the main accounting systems • an audit of the 2021/22 annual accounts and provision of an Independent Auditor’s Report • provision of an audit opinion on the other statutory information published within the annual accounts including the Management Commentary, the Annual Governance Statement, and the audited part of the Remuneration Report • consideration of arrangements in relation to the audit dimensions that frame the wider scope of public sector audit: financial management, financial sustainability, governance and transparency and value for money • consideration of the council’s Best Value arrangements • providing assurance on the Housing Benefit Subsidy Claim and Non-Domestic Rates Income Return • review of the council’s arrangements for preparing and publishing statutory performance information • review of the council’s participation in the National Fraud Initiative. Impact of Covid-19 2. The coronavirus disease (Covid-19) pandemic has had a significant impact on public services and public finances, and the effects will be felt well into the future. 3. The Accounts Commission and Audit Scotland continue to assess the risks to public services and finances from Covid-19 across the full range of our audit work, including annual audits and the programme of performance audits. The well-being of audit teams and the delivery of high-quality audits remain paramount. Changes in our approach may be necessary and where this impacts on annual audits, revisions to this Annual Audit Plan may be required. Page 41
Page 42
Introduction | 4 Adding value 4. We aim to add value to the council through our external audit work by being constructive and forward looking, by identifying areas for improvement and by recommending and encouraging good practice. In so doing, we will help the council promote improved standards of governance, better management and decision making and more effective use of resources. Additionally, we attend meetings of the Audit and Scrutiny Committee and actively participate in discussions. Respective responsibilities of the auditor and Moray Council 5. The Code of Audit Practice (2016) sets out in detail the respective responsibilities of the auditor and the council. Key responsibilities are summarised below. Auditor responsibilities 6. Our responsibilities as independent auditors are established by the Local Government (Scotland) Act 1973 and the Code of Audit Practice (including supplementary guidance) and guided by the Financial Reporting Council’s Ethical Standard. 7. Auditors in the public sector give an independent opinion on the financial statements and other information within the annual accounts. We also review and report on the arrangements within the audited body to manage its performance and use of resources. In doing this, we aim to support improvement and accountability. Moray Council’s responsibilities 8. The council is responsible for maintaining accounting records and preparing financial statements that give a true and fair view. 9. The council also has primary responsibility for ensuring the proper financial stewardship of public funds, compliance with relevant legislation and establishing effective arrangements for governance, propriety and regularity that enable them to deliver their objectives. Managing the transition to 2022/23 audits 10. Audit appointments are usually for five years but were extended to six years due to Covid-19. 2021/22 is the final year of the current appointment and we will work closely with our successors to ensure a well-managed transition. Page 42
Page 43
Financial statements audit planning | 5 Financial statements audit planning Materiality 11. Materiality is an expression of the relative significance of a matter in the context of the financial statements as a whole. We are required to plan our audit to determine with reasonable confidence whether the financial statements are free from material misstatement. The assessment of what is material is a matter of professional judgement over both the amount and the nature of the misstatement. Materiality levels for the 2021/22 audit 12. We assess materiality at different levels as described below. The materiality values for the council and its group are set out in Exhibit 1. Exhibit 1 2021/22 Materiality levels for Moray Council and its group Materiality Council Group Planning materiality – This is the figure we calculate to assess the overall impact of audit adjustments on the financial statements. It has been set at 1% of gross expenditure for the year ended 31 March 2022 based on the latest audited financial statements for 2020/21. £3.6 million £3.6 million Performance materiality – This acts as a trigger point. If the aggregate of errors identified during the financial statements audit exceeds performance materiality, this would indicate that further audit procedures should be considered. Using our professional judgement, we have assessed performance materiality at 60% of planning materiality. £2.2 million £2.2 million Reporting threshold (i.e. clearly trivial) – We are required to report to those charged with governance on all unadjusted misstatements more than the ‘reporting threshold' amount. £150,000 £150,000 Source: Audit Scotland Page 43
Page 44
Financial statements audit planning | 6 Significant risks of material misstatement to the financial statements 13. Our risk assessment draws on our cumulative knowledge of the council, its major transaction streams, key systems of internal control and risk management processes. It is also informed by our discussions with management, meetings with internal audit, attendance at committees and a review of supporting information. 14. Based on our risk assessment process, we identified the following significant risks of material misstatement to the financial statements. These are risks which have the greatest impact on our planned audit procedures. Exhibit 2 summarises the nature of the risk, the sources of assurance from management arrangements and the further audit procedures we plan to perform to gain assurance over the risk. Exhibit 2 2021/22 Significant risks of material misstatement to the financial statements Significant risk of material misstatement Sources of assurance Planned audit response 1. Risk of material misstatement due to fraud caused by the management override of controls As stated in International Standard on Auditing (UK) 240, management is in a unique position to perpetrate fraud because of management’s ability to override controls that otherwise appear to be operating effectively. Owing to the nature of this risk, assurances from management are not applicable in this instance • Assess the design and implementation of controls over journal entry processing. • Make inquiries of individuals involved in the financial reporting process about inappropriate or unusual activity relating to the processing of journal entries and other adjustments. • Test journals at the year-end and post-closing entries and focus on significant risk areas. • Consider the need to test journal entries and other adjustments during the period. • Evaluate significant transactions outside the normal course of business. • Assess the adequacy of controls in place for identifying and disclosing related party relationship and transactions in the financial statements. • Assess any changes to the methods and underlying assumptions used to prepare accounting estimates compared to the prior year. Page 44
Page 45
Financial statements audit planning | 7 Significant risk of material misstatement Sources of assurance Planned audit response • Substantively test income and expenditure transactions around the year-end to confirm they are accounted for in the correct financial year. • Test accounting accruals and prepayments focusing on significant risk areas. 2. Estimation in the valuation of land and buildings The cp;ouncil held land and buildings with a net book value of £707 million at 31 March 2021, with land and buildings revalued on a five- year rolling basis. There is a significant degree of subjectivity in the valuation of land and buildings. Valuations are based on specialist and management assumptions and changes in these can result in material changes to valuations. A full valuation exercise of council dwellings was completed during 2020/21, with schools valued in 2018/19. The council has not applied indexation in intervening years previously but plans to introduce this for housing and schools in 2021/22. The council is also introducing a new asset register system in 2021/22. There is a risk that the carrying amount of assets differs materially from the current value at the end of the reporting period. • The council has clearly defined procedures in place, including the use of experts to make significant estimations and judgements. • Estimates and valuations are reviewed by qualified finance staff. • Review the information provided to the valuer to assess for completeness. • Evaluate the competence, capabilities, and objectivity of the professional valuer. • Complete a walkthrough of the valuation process to obtain an understanding of the process, including the methodologies and assumptions applied. • Review of reports from the valuer to confirm overall asset valuation. • Obtain an understanding of management’s involvement in the valuation process to assess if appropriate oversight has occurred. • Examine management’s assessment of any assets not revalued in 2021/22 against evidence of changes in other revalued assets. • Test the reconciliation between the financial ledger and the property asset register. • Sample test individual asset valuations and lives. Source: Audit Scotland Page 45
Page 46
Financial statements audit planning | 8 15. As set out in International Standard on Auditing (UK) 240: The auditor’s responsibilities relating to fraud in an audit of financial statement, there is a presumed risk of fraud over the recognition of revenue. We have considered the risk that revenue may be misstated resulting in a material misstatement in the financial statements. We also considered the risk of fraud over expenditure, as most public bodies are net spending bodies, and the risk of external fraud (in accordance with Practice Note 10: Audit of Financial Statements and Regularity of Public Sector Bodies in the UK). 16. We have rebutted the presumption that a material risk exists, with the exception of management override, as noted above. This is on the basis that: • there are generally no incentives for staff to commit fraudulent financial reporting • a significant portion of the council’s income comes from government grants and contributions that can be readily agreed to funding letters • an effective control environment operates around income from council tax and non-domestic rates billing • income derived from fees and charges for the provision of services is well controlled with controls around access to financial systems, segregation of duties, and reconciliations that prevent and detect the risk of misstatement • most expenditure is in low-risk areas where individual transactions are well- controlled (for example salaried staff costs in a well-defined grading system) and individual transactions are relatively small in scale, with management approval required for material transactions • evidence of external fraud from counter fraud services and the National Fraud Initiative does not indicate material risk • experience in the sector and from prior year audits of the council, including a review of past misstatements, does not indicate material risk. 17. Our audit testing is directed towards testing significant and unusual transactions and towards assessing accounting estimates to address any residual risk, as part of our standard fraud procedures. We have not, therefore, incorporated specific work into our audit plan in these areas over and above our standard audit procedures. Other areas of audit focus 18. As part of our assessment of audit risks, we have identified other areas where we consider there are also risks of material misstatement to the financial statements. Based on our assessment of the likelihood and magnitude of the risk, we do not consider these to represent significant risks. We will keep these areas under review as our audit progresses. If our assessment of risk changes and we consider these risks to be significant, we will communicate this to management and those charged with governance and revise our planned audit approach accordingly. Page 46
Page 47
Financial statements audit planning | 9 19. The areas of specific audit focus are: • Valuation of IAS19 net pensions liability: Actuarial estimates are a complex combination of liabilities over significant future periods based on life expectancy and CPI growth. These are subject to significant discounting based on corporate bond rates. Assets are based on individual employer body shares of assets at last triennial valuation. Roll forward adjustments are provided to members data and to asset valuations. We will assess the scope, independence and competence of the professionals engaged in providing estimates for pensions and review appropriateness of actuarial assumptions and results including comparison with other councils. We will establish officers’ arrangements for ensuring the reasonableness of professional estimations and the accuracy of information provided to the actuary by the council. Group consideration 20. As group auditors, we are required under International Standard on Auditing (UK) 600: Audits of group financial statements (including the work of component auditors) to obtain sufficient appropriate audit evidence on which to base our audit opinion on the group financial statements. 21. The council has a group which comprises component entities, including subsidiaries, associates, and joint ventures. The audits of the financial information of some of the components are performed by other auditors. We plan to place reliance on the work of the component auditors. We will obtain sufficient appropriate audit evidence in relation to the consolidation process and the financial information of the components on which to base our group audit opinion. Audit of trusts registered as Scottish charities 22. Members of Moray Council are sole trustees for 8 trusts registered as Scottish charities, with net assets of £978,000. The preparation and audit of financial statements of registered charities is regulated by the Charities and Trustee Investment (Scotland) Act 2005 and the Charities Accounts (Scotland) Regulations 2006. 23. The 2006 Regulations require charities to prepare annual accounts and require an accompanying auditor’s report where any legislation requires an audit. The Local Government (Scotland) Act 1973 specifies the audit requirements for any trust fund where some or all members of a council are the sole trustees. Therefore, a full and separate audit and independent auditor’s report is required for each registered charity where members of the council are sole trustees, irrespective of the size of the charity. Materiality levels for the 2021/22 audit of trusts registered as Scottish charities 24. Materiality levels for the charitable trusts are set out in Exhibit 3. Page 47
Page 48
Financial statements audit planning | 10 Exhibit 3 2021/22 materiality levels for charitable trusts Materiality Amount Planning materiality – This is the figure we calculate to assess the overall impact of audit adjustments on the financial statements. It has been set at 2% of gross assets based on the latest audited financial statements for 2020/21. £20,000 Performance materiality – This acts as a trigger point. If the aggregate of errors identified during the financial statements audit exceeds performance materiality, this would indicate that further audit procedures should be considered. Using our professional judgement, we have assessed performance materiality at 75% of planning materiality. £15,000 Reporting threshold (i.e. clearly trivial) – We are required to report to those charged with governance on all unadjusted misstatements more than the ‘reporting threshold' amount. £1,000 Source: Audit Scotland 25. Based on our discussions with staff and initial planning work we have identified the following risk for the audit of the charitable trusts: management override of controls. This risk has been included in Exhibit 2. Audit risk assessment process 26. Audit risk assessment is an iterative and dynamic process. Our assessment of risks set out in this plan may change as more information and evidence becomes available during the progress of the audit. Where such changes occur, we will advise management and where relevant, report them to those charged with governance. Page 48
Page 49
Audit dimensions and Best Value | 11 Audit dimensions and Best Value Introduction 27. The Code of Audit Practice sets out the four dimensions that frame the wider scope of public sector audit. The Code of Audit Practice requires auditors to consider the adequacy of the arrangements in place for the audit dimensions in audited bodies. Audit dimensions 28. The four dimensions that frame our audit work are shown in Exhibit 4. Exhibit 4 Audit dimensions Source: Code of Audit Practice 29. In summary, the four dimensions cover the following: • Financial management – financial management is concerned with financial capacity, sound budgetary processes and whether the control environment and internal controls are operating effectively. • Financial sustainability – as auditors, we consider the appropriateness of the use of the going concern basis of accounting as part of the annual audit. We Page 49
Page 50
Audit dimensions and Best Value | 12 will also comment on financial sustainability in the longer term. We define this as medium term (two to five years) and longer term (longer than five years). • Governance and transparency – governance and transparency is concerned with the effectiveness of scrutiny and governance arrangements, leadership, and decision-making and transparent reporting of financial and performance information. • Value for money – value for money refers to using resources effectively and continually improving services. Best Value 30. 2021/22 is the final year of the extended six-year approach to auditing Best Value in councils. Best Value work is integrated within the annual audit. It is assessed comprehensively over the period of the audit appointment, both through ongoing annual audit work and through discrete packages of work focussing on specific issues. Conclusions and judgements on Best Value are reported through: • the Annual Audit Report for each council that provides a rounded picture of the council overall. • an Annual Assurance and Risks Report that the Controller of Audit will provide to the Accounts Commission that will highlight issues from across all 32 council annual audit reports. • a Best Value Assurance Report (BVAR) for each council that will be considered by the Accounts Commission at least once over the period of the audit appointment. 31. BVARs will be considered by the Accounts Commission between February and September 2022 on the councils listed in Exhibit 5. Exhibit 5 2022 Best Value Assurance Reports Moray Council follow-up Shetland Island Council Angus Council Comhairle nan Eilean Siar Source: Audit Scotland Page 50
Page 51
Audit dimensions and Best Value | 13 32. The Best Value work planned in Moray Council this year will focus on equalities and the council’s response to the follow-up report published in March 2022. The results of this work will be reported in the Annual Audit Report. Audit dimension risks 33. No new audit dimension risks have been identified for the council in 2021/22. Progress on the outstanding audit dimension risks identified in prior years will be followed-up with management during the course of the 2021/22 audit. Page 51
Page 52
Reporting arrangements, timetable, and audit fee | 14 Reporting arrangements, timetable, and audit fee Reporting arrangements 34. Audit reporting is the visible output for the annual audit. All Annual Audit Plans and the outputs, as detailed in Exhibit 6, and any other outputs on matters of public interest will be published on our website: www.audit-scotland.gov.uk. 35. Matters arising from our audit will be reported on a timely basis and will include agreed action plans. Draft management reports will be issued to the relevant officers to confirm factual accuracy. 36. We will provide an independent auditor’s report to the council and the Accounts Commission setting out our opinions on the annual accounts. We will also provide the council and the Accounts Commission with an annual report on the audit containing observations and recommendations on significant matters which have arisen during the audit. 37. Exhibit 6 outlines the target dates for our audit outputs, and we aim to issue the independent auditor’s report by 31 October 2022. We acknowledge this will be challenging due to the ongoing pressures and uncertainties caused by Covid-19. The Committee dates are not yet agreed and so are subject to change. Exhibit 6 2021/22 audit outputs Audit Output Target date Committee date Annual Audit Plan 30 April 2022 28 June 2022 Independent Auditor's Report 31 October 2022 26 October 2022 Annual Audit Report 31 October 2022 26 October 2022 Source: Audit Scotland Page 52
Page 53
Reporting arrangements, timetable, and audit fee | 15 Timetable 38. Covid-19 has had a considerable impact on the conduct and timeliness of the audit. We recognise that it is in the best interests of public accountability to get the reporting of audited accounts back to pre-pandemic timelines. To this end, 2021/22 is a transition year with the reporting deadline brought forward by one month relative to the two prior years. We are identifying ways to work more efficiently to expedite the 2021/22 audits whilst at the same time maintaining high standards of quality. 39. We have included a proposed timetable for the audit at Exhibit 7 that has been discussed with management. Progress against this timetable will be discussed with management and finance officers over the course of the audit. Exhibit 7 Proposed annual accounts timetable Key stage Provisional Date Consideration of the unaudited annual accounts by those charged with governance 29 June 2022 Latest submission date for the receipt of the unaudited annual accounts with complete working papers package. 30 June 2022 Latest date for final clearance meeting with the Chief Financial Officer 28 September 2022 Agreement of audited unsigned annual accounts Issue of Annual Audit Report to those charged with governance 12 October 2022 Council meeting to consider the Annual Audit Report and approve the audited annual accounts for signature 26 October 2022 Signed Independent Auditor’s Report 26 October 2022 Source: Audit Scotland 40. To support an efficient audit, it is critical that high quality unaudited accounts and supporting working papers are provided and that the timetable for producing the annual accounts for audit is achieved. Page 53
Page 54
Reporting arrangements, timetable, and audit fee | 16 Audit fee 41. The agreed audit fee for the 2021/22 audit of the council is £251,340 (2020/21: £246,240). In determining the audit fee, we have taken account of the risk exposure of the council, the planned management assurances in place and the level of reliance we plan to take from the work internal audit. 42. We have also agreed an audit fee of £5,440 (2020/21: £5,330) for the charitable trusts. 43. Where our audit cannot proceed as planned through, for example, late receipt of the unaudited annual accounts, the absence of adequate supporting working papers or being unable to take planned reliance from the work of internal audit, a supplementary fee may be levied. An additional fee may also be required in relation to any work or other significant exercises outwith our planned audit activity. Page 54
Page 55
Other matters | 17 Other matters Internal audit 44. Internal audit is provided by Moray Council’s internal audit section. International standards on Auditing (UK) 610: Considering the work of internal audit requires us to: • consider the activities of internal audit and their effect on external audit procedures • obtain an understanding of internal audit activities to inform our planning and develop an effective audit approach that avoids duplication of effort • perform a preliminary assessment of the internal audit function when there is scope for relying on internal audit work which is relevant to our financial statements' responsibilities • evaluate and test the work of internal audit, where use is made of that work for our financial statements responsibilities to confirm its adequacy for our purposes. 45. We plan to place formal reliance on internal audit’s work on housing benefits payments (substantive testing) to support our opinion on the council’s Housing Benefits Subsidy claim. Independence and objectivity 46. Auditors appointed by the Accounts Commission must comply with the Code of Audit Practice and relevant supporting guidance. When auditing the financial statements, auditors must also comply with professional standards issued by the Financial Reporting Council and those of the professional accountancy bodies. These standards impose stringent rules to ensure the independence and objectivity of auditors. Audit Scotland has robust arrangements in place to ensure compliance with these standards including an annual ‘fit and proper’ declaration for all members of staff. The arrangements are overseen by the Director of Audit Services, who serves as Audit Scotland’s Ethics Partner. 47. The engagement lead (i.e. appointed auditor) for Moray Council is Brian Howarth, Audit Director and for the charitable trusts is Maggie Bruce, Senior Audit Manager. Auditing and ethical standards require the appointed auditor to communicate any relationships that may affect the independence and objectivity of audit staff. We are not aware of any such relationships pertaining to the audit of Moray Council or the charitable trusts. Page 55
Page 56
Other matters | 18 Quality control 48. International Standard on Quality Control (UK) 1 (ISQC1) requires a system of quality control to be established, as part of financial audit procedures, to provide reasonable assurance that professional standards and regulatory and legal requirements are being complied with and that the independent auditor’s report or opinion is appropriate in the circumstances. 49. The foundation of our quality framework is our Audit Guide, which incorporates the application of professional auditing, quality and ethical standards and the Code of Audit Practice (and supporting guidance) issued by Audit Scotland and approved by the Auditor General for Scotland. To ensure that we achieve the required quality standards, Audit Scotland conducts peer reviews and internal quality reviews. Additionally, the Institute of Chartered Accountants of Scotland (ICAS) have been commissioned to carry out external quality reviews. 50. As part of our commitment to quality and continuous improvement, Audit Scotland will periodically seek your views on the quality of our service provision. We welcome feedback at any time, and this may be directed to the engagement lead. Page 56
Page 57
Other matters | 19 Moray Council Annual Audit Plan 2021/22 Audit Scotland’s published material is available for download on the website in a number of formats. For information on our accessibility principles, please visit: www.audit-scotland.gov.uk/accessibility For the latest news follow us on social media or subscribe to our email alerts. Audit Scotland, 4th Floor, 102 West Port, Edinburgh EH3 9DN Phone: 0131 625 1500 Email: info@audit-scotland.gov.uk www.audit-scotland.gov.uk AS.4.0 Page 57
Page 58
Page 58